fix(core)!: Add min_len to search term.

[c-r33d]

1.) Set min_len of search term to 1 when the field is present
2.) Remove Search from ListRegisteredResourceValues and ListObligationTriggers

Summary by CodeRabbit

• Bug Fixes

  • Enforced minimum length validation for search terms to prevent empty searches.
  • Fixed field numbering conflicts in request messages.

• Refactor

  • Updated request schemas to improve pagination handling in policy service requests.

[coderabbitai]

📝 Walkthrough

Walkthrough

Search.term in selectors.proto gains a min_len: 1 Buf validation constraint (previously max-only). ListObligationsRequest renumbers the search field from 11 to 12 to resolve a conflict with sort. ListRegisteredResourceValuesRequest replaces its search field with pagination. All OpenAPI specs and the gRPC HTML doc are regenerated to match.

Changes

Policy proto/OpenAPI validation and request schema fixes

Layer / File(s)	Summary
Proto source changes: validation, field numbering, and request shape service/policy/selectors.proto, service/policy/obligations/obligations.proto, service/policy/registeredresources/registered_resources.proto	Search.term adds min_len: 1; ListObligationsRequest.search renumbered to field 12; ListRegisteredResourceValuesRequest replaces optional search with optional pagination at field 10.
OpenAPI: Search.term minLength:1 across all policy specs docs/openapi/policy/selectors.openapi.yaml, docs/openapi/policy/attributes/attributes.openapi.yaml, docs/openapi/policy/kasregistry/...yaml, docs/openapi/policy/namespaces/...yaml, docs/openapi/policy/obligations/...yaml, docs/openapi/policy/registeredresources/...yaml, docs/openapi/policy/subjectmapping/...yaml	minLength: 1 added to policy.Search.term in all seven OpenAPI spec files to reflect the proto validation change.
OpenAPI: request schema search→pagination replacements docs/openapi/policy/obligations/obligations.openapi.yaml, docs/openapi/policy/registeredresources/registered_resources.openapi.yaml	ListObligationTriggersRequest replaces search with a pagination reference; ListRegisteredResourceValuesRequest removes the search property entirely.
gRPC HTML doc: pagination field description reflow docs/grpc/index.html	Whitespace-only reformatting of the pagination field description markup in the ListObligationTriggersRequest and ListRegisteredResourceValuesRequest table sections.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• opentdf/platform#3300: Adds a sort field at tag = 11 in ListObligationsRequest, which is the direct cause of the field-number conflict this PR resolves by renumbering search to = 12.
• opentdf/platform#3547: Introduced policy.Search/term and list-request search fields for obligations and registered resources that this PR now tightens with min_len: 1 validation and partial schema replacements.

Suggested labels

size/s

Suggested reviewers

• elizabethhealy

🐇 A term that's blank? Oh, never again!
The proto says one char at minimum, friend.
Field twelve for search, field ten for the page,
The schemas are tidy, corrected each stage.
I hop through the YAML with joy in my feet —
Empty strings banished, the spec is complete! ✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the main change: adding a minimum length constraint to search terms across multiple schema definitions.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch set-min-len-search

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[gemini-code-assist]

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request updates the validation logic for search terms in the core service. By enforcing a minimum length of 1 character, it ensures that search queries are not empty, improving data integrity and search reliability.

Highlights

• Validation constraint update: Added a minimum length requirement of 1 character to the 'term' field within the 'Search' message to prevent empty search queries.

New Features

🧠 You can now enable Memory (public preview) to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Ignored Files

• Ignored by pattern: docs/openapi/**/* (7)
  • docs/openapi/policy/attributes/attributes.openapi.yaml
  • docs/openapi/policy/kasregistry/key_access_server_registry.openapi.yaml
  • docs/openapi/policy/namespaces/namespaces.openapi.yaml
  • docs/openapi/policy/obligations/obligations.openapi.yaml
  • docs/openapi/policy/registeredresources/registered_resources.openapi.yaml
  • docs/openapi/policy/selectors.openapi.yaml
  • docs/openapi/policy/subjectmapping/subject_mapping.openapi.yaml
• Ignored by pattern: protocol/**/* (1)
  • protocol/go/policy/selectors.pb.go

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

---

A search term short and sweet, / With length of one complete. / No empty strings allowed, / To keep the system proud.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request updates the Search message in service/policy/selectors.proto to enforce a minimum length of 1 on the term field. Feedback on this change highlights that the generated Go files must be regenerated and committed for the validation to take effect at runtime. Additionally, because proto3 string fields default to an empty string, adding min_len: 1 will cause validation to fail when the field is omitted; it is recommended to ignore the default value during validation using IGNORE_IF_DEFAULT.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	138.360324ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	68.867813ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	350.859511ms
Throughput	285.01 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	33.682829659s
Average Latency	334.247969ms
Throughput	148.44 requests/second

[github-actions]

X-Test Results

bats-test-results
✅ go@main-pull-3603
✅ go@main-v0.9.0
✅ java@main-pull-3603
✅ java@main-v0.9.0
✅ js@main-v0.9.0
✅ js@main-pull-3603
cukes-report
opentdfplatformZMKQFQ.dockerbuild
govulncheck-failure-3
govulncheck-failure-2
govulncheck-failure-8
govulncheck-failure-1
govulncheck-failure-0
govulncheck-failure-5

[github-actions]

X-Test Failure Report

opentdfplatformA1ZQDM.dockerbuild
govulncheck-failure-3
govulncheck-failure-5
govulncheck-failure-1
govulncheck-failure-8
govulncheck-failure-2
govulncheck-failure-0

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	149.203148ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	84.764911ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	404.200487ms
Throughput	247.40 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	42.326308971s
Average Latency	421.279816ms
Throughput	118.13 requests/second

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	140.571498ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	73.09812ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	383.670418ms
Throughput	260.64 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	34.508049283s
Average Latency	343.749448ms
Throughput	144.89 requests/second

[github-actions]

⚠️ Govulncheck found vulnerabilities ⚠️

The following modules have known vulnerabilities:

• examples
• otdfctl
• sdk
• service
• lib/fixtures
• tests-bdd

See the workflow run for details.

[github-actions]

X-Test Results

✅ go@main-pull-3604
✅ go@main-v0.9.0
✅ java@main-pull-3604
✅ java@main-v0.9.0
✅ js@main-pull-3604
✅ js@main-v0.9.0
cukes-report
opentdfplatformI5MTDG.dockerbuild
govulncheck-failure-8
govulncheck-failure-3
govulncheck-failure-0
govulncheck-failure-2
govulncheck-failure-5
govulncheck-failure-1

[opentdf-automation]

Successfully created backport PR for release/protocol/go/v0.33:

• fix(core)!: Add min_len to search term. [backport to release/protocol/go/v0.33] #3605